tree 3f29a0772e9182a7e7cc0073b61b00f58013e071
parent fa5c2fccc528b40f216687e02f0c1cd004e013d6
author Lorenz Brun <lorenz@nexantic.com> 1600792515 +0200
committer Lorenz Brun <lorenz@nexantic.com> 1600792515 +0200

Add support for runc container runtime

Adds the runc container runtime, its containerd shim, required Linux features and plumbs it into
Kubernetes using RuntimeClasses and containerd runtime selection. Also adds support for building C-based
targets as part of our initramfs.

The Bazel portion is a bit verbose but since label dicts cannot be reasonably concatenated and closures
are prohibited in Starlark I see no better way.

For this to be usable for most images new Linux binfmt options have been added. The hashbang binfmt
shouldn't have any negative impact, but binfmt_misc has a registry which is only namespaced if used
with user namespaces, which are currently not used and thus might represent an exploit vector. This
is tracked in T864.

Test Plan: New E2E tests covering this feature have been added.

X-Origin-Diff: phab/D625
GitOrigin-RevId: 1e7e27166135437b2965eca4dc238f3255c9b1ba